Detection rules › By event

Kubernetes-clusterroles

Event	Rules
get-clusterroles	2
list-clusterroles	2
watch-clusterroles	1
create-clusterroles	11
update-clusterroles	10
patch-clusterroles	10
delete-clusterroles	3
any-clusterroles	1

get-clusterroles

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Multi-Resource Discovery severity medium T1613

list-clusterroles

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Multi-Resource Discovery severity medium T1613

watch-clusterroles

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610

create-clusterroles

11 detection rules reference this event. View event page.

Elastic (7)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Creation or Modification of Sensitive Role severity medium T1098,T1098.006
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098,T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Creation or Modification of Sensitive Role severity medium T1098,T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

Panther (4)

Kubernetes Role With Node Proxy Permissions Created severity high T1078.004,T1685
Kubernetes Role With Pod Exec Permissions Created severity high T1021,T1078.004
Kubernetes Role With Wildcard Permissions Created severity high T1078.004
Kubernetes Role With Write Permissions Created severity low T1222

update-clusterroles

10 detection rules reference this event. View event page.

Elastic (9)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Creation or Modification of Sensitive Role severity medium T1098,T1098.006
GKE RBAC Wildcard Elevation on Existing Role severity high T1098,T1098.006
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098,T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Creation or Modification of Sensitive Role severity medium T1098,T1098.006
Kubernetes RBAC Wildcard Elevation on Existing Role severity high T1098,T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

Panther (1)

Kubernetes System Role Modified or Deleted severity critical T1078.004,T1098,T1222

patch-clusterroles

10 detection rules reference this event. View event page.

Elastic (9)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059,T1059.004,T1069,T1087,T1609,T1610
GKE Creation or Modification of Sensitive Role severity medium T1098,T1098.006
GKE RBAC Wildcard Elevation on Existing Role severity high T1098,T1098.006
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098,T1098.006
GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Creation or Modification of Sensitive Role severity medium T1098,T1098.006
Kubernetes RBAC Wildcard Elevation on Existing Role severity high T1098,T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

Panther (1)

Kubernetes System Role Modified or Deleted severity critical T1078.004,T1098,T1222

delete-clusterroles

3 detection rules reference this event. View event page.

Elastic (2)

GKE Service Account Modified RBAC Objects severity medium T1098,T1098.006
Kubernetes Service Account Modified RBAC Objects severity medium T1098,T1098.006

Panther (1)

Kubernetes System Role Modified or Deleted severity critical T1078.004,T1098,T1222

any-clusterroles

1 detection rules reference this event. View event page.

Elastic (1)

Kubernetes Multi-Resource Discovery severity medium T1613